Individual authentication apparatus, individual authentication method, and computer program

ABSTRACT

An authentication processing apparatus for performing authentication based on a user&#39;s normal operation is provided. The authentication processing apparatus performs the authentication processing on the basis of operation information obtained from normally operating an information processing apparatus. Operation information obtained from operating an input unit by the user, such as a keyboard inputting mode, is obtained to serve as operation information, and the obtained operation information is checked against operation information registered in a database to perform authentication. Authentication is thus made possible without requiring the user to perform the special input processing for the authentication processing. Authentication is performed taking into consideration a plurality of pieces of operation information. With the checking processing in which less dispersed data is weighted, user authentication with high accuracy is made possible.

TECHNICAL FIELD

The present invention relates to individual authentication processingapparatuses and individual authentication processing methods, and moreparticularly to an individual authentication processing apparatus andindividual authentication processing method for performingauthentication based on an individual's operation characteristicsincluded in normal keyboard operations by the individual for whichauthentication is performed and to a computer program.

BACKGROUND ART

One typical known individual authentication processing system performsauthentication based on a key such as a password. FIG. 1 shows aprocessing sequence of a known authentication system for performingauthentication by receiving a password at the time the processing on aninformation processing apparatus (for example, a PC) starts.

FIG. 1 shows time course in the abscissa axis and illustrates theprocessing performed in accordance with the flow of time. Anauthentication unit 101 performs the authentication processing. Theauthentication unit 101 is provided in the interior of an informationprocessing apparatus used by unspecified users, such as a PC serving asa user terminal or an information terminal or financial terminal locatedin a public place, or a server connected with a network over which userinput information can be transferred.

The authentication unit 101 stores a password corresponding to apre-registered user in a storage unit and checks a password input from auser against the password stored in the storage unit. When the checkingprocessing determines that the password input from the user agrees withthe password stored in the storage unit, it is determined that theauthentication is successful. If the two passwords disagree with eachother, it is determined that the authentication is unsuccessful.

Only when the authentication is successful, the processing based on auser operation performed subsequent to the authentication is performed.The user operation is diverse, ranging from, for example, obtaining datafrom storage means in a PC having the authentication unit, updatingdata, drawing money from the financial terminal, and downloading datafrom the server through the network.

The processing sequence shown in FIG. 1 is such that, when theauthentication is successful on the basis of the password input once, aseries of subsequent processes is unconditionally performed. Forexample, a user of a PC is authenticated using a password prior tooperating the PC, as shown in FIG. 1. The user who has beenauthenticated leaves the PC. When a different user operates the PC, theprocessing based on the operation is performed. As discussed above, theconfiguration dependent solely on authentication executed as theso-called log-in processing is disadvantageous in that, when anoperation is subsequently performed by a different user, the operationcannot be distinguished from the processing by the authenticate user.

In order to remove such disadvantages, for example, there is aprocessing sequence shown in FIG. 2. Similar to FIG. 1, FIG. 2 showstime course in the abscissa axis and illustrates the processingperformed in accordance with the flow of time. An authentication unit201 performs the authentication processing. Similar to FIG. 1, theauthentication unit 201 is provided in the interior of an informationprocessing apparatus used by unspecified users, such as a PC serving asa user terminal or an information terminal or financial terminal locatedin a public space, or a server connected with a network over which userinput information can be transferred.

The processing sequence shown in FIG. 2 performs the authenticationprocessing every time the user operation is performed. When theauthentication is successful once, only one operation immediately afterthe authentication is permitted. As discussed above, the authenticationprocessing and operation permission are repetitively performed everytime an operation is performed. Accordingly, unauthorized use by adifferent user, which is described with reference to FIG. 1, can beeliminated. However, the processing sequence of FIG. 2 requires the userto input a key such as a password every time the user performs anoperation. As a result, the operation becomes complicated, and theprocessing efficiency is reduced.

DISCLOSURE OF INVENTION

In view of the foregoing problems, the present invention provides theconfiguration for obtaining personal characteristics from operationsperformed by a user and sequentially performing the authenticationprocessing based on the obtained personal characteristics.

It is an object of the configuration of the present invention to solvethe problems of the log-in authentication described using FIG. 1, thatis, the problem in that an operation by a different user cannot bedistinguished subsequent to authentication, and to provide an individualauthentication processing apparatus, an individual authenticationprocessing method, and a computer program for eliminating the necessityto input a key such as a password every time an operation is performed,which is described using FIG. 2.

A first aspect of the present invention is an individual authenticationprocessing apparatus for performing individual authentication. Theindividual authentication processing apparatus obtains normal operationinformation from normally operating, by a user, input means of aninformation processing apparatus; extracts an individual's operationcharacteristic information from the normal operation information; checksthe individual's extracted operation characteristic information againsta registered user's operation characteristic information stored instorage means; generates, on the basis of a result of the checkingprocessing, permission information for determining whether or not topermit the processing in accordance with user operation of the inputmeans to be performed on the information processing apparatus; andoutputs the generated permission information to the informationprocessing apparatus.

According to an embodiment of the individual authentication processingapparatus of the present invention, when generating the permissioninformation, the individual authentication processing apparatus refersto past checking log data stored in a checking result memory that storespast checking results, generates the permission information based on thechecking log data, and outputs the permission information to theinformation processing apparatus.

According to the embodiment of the individual authentication processingapparatus of the present invention, the operation characteristicinformation is information on characteristics of key input with akeyboard serving as the input means. The operation characteristicinformation is information including DDn representing time from pressinga previously input key to pressing a subsequently input key; UDnrepresenting time from pressing a key to releasing the key; and DUnrepresenting time from releasing the previously input key to pressingthe subsequently input key. The checking processing against theregistered user's operation characteristic information stored in thestorage means is performed by comparing a distance value d with apredetermined threshold, the distance value d being between inputvectors DD, UD, and DU formed of the DDn, UDn, and DUn and mean vectors[DD], [UD], and [DU] of the registered user's operation characteristicinformation stored in the storage means.

According to the embodiment of the individual authentication processingapparatus of the present invention, the distance value d is computed onthe basis of the equation d=|DD−[DD]|+k|UD−[UD]|+l|UD−[DU]| where k andl are coefficients.

According to the embodiment of the individual authentication processingapparatus of the present invention, the storage means stores integratedpieces of operation characteristic information data concerning the sameoperation by the registered user. The checking processing of theoperation characteristic information extracted from the normal operationinformation is performed by weighting less dispersed data of theintegrated pieces of characteristic information data concerning the sameoperation by the registered user, which are stored in the storage means,more heavily than widely dispersed data.

According to the embodiment of the individual authentication processingapparatus of the present invention, the operation characteristicinformation is information on characteristics of key input with akeyboard serving as the input means. The operation characteristicinformation is information including DDn representing time from pressinga previously input key to pressing a subsequently input key; UDnrepresenting time from pressing a key to releasing the key; and DUnrepresenting time from releasing the previously input key to pressingthe subsequently input key. The checking processing against theregistered user's operation characteristic information stored in thestorage means is performed by comparing a distance value d with apredetermined threshold, the distance value d being computed on thebasis of the equationd=|(DD−[DD])/σDD|+k|(UD)−[UD])/σUD|+l|(DU−[DU])/σDU| where DD, UD, andDU are input vectors formed of the DDn, UDn, and DUn, [DD], [UD], and[DU] are mean vectors of the registered user's operation characteristicinformation stored in the storage means, σDD, σUD, and σDU are standarddeviation vectors obtained on the basis of the registered user'soperation characteristic information stored in the storage means, and kand l are coefficients.

According to the embodiment of the individual authentication processingapparatus of the present invention, the individual authenticationprocessing apparatus includes a keyword registration database thatstores a word based on which the authentication processing is performedas a keyword. On condition that it is detected that the word registeredin the keyword registration database is input from the input means, thechecking processing is performed on the basis of normal operationinformation obtained from normally operating the input means by theuser.

According to the embodiment of the individual authentication processingapparatus of the present invention, the normal operation information isinformation concerning an operation sequence of a mouse. The storagemeans stores the registered user's mouse operation sequence informationas the operation characteristic information. The checking processing isperformed by checking against the mouse operation sequence information.

According to the embodiment of the individual authentication processingapparatus of the present invention, the normal operation information isinformation concerning a processing sequence of a program executable bythe information processing apparatus. The storage means stores theregistered user's program processing sequence information as theoperation characteristic information. The checking processing isperformed by checking against the program processing sequenceinformation.

According to the embodiment of the individual authentication processingapparatus of the present invention, the normal operation information isinformation on the frequency of inputting a specific key. The storagemeans stores the registered user's specific key inputting frequencyinformation as the operation characteristic information. The checkingprocessing is performed by checking against the specific key inputtingfrequency information.

According to the embodiment of the individual authentication processingapparatus of the present invention, the individual authenticationprocessing apparatus includes an operation unit serving as the inputmeans that outputs a code in accordance with the user operation; anextraction unit that extracts an individual's operation characteristicinformation from normal operation information obtained from normallyoperating the operation unit by a user; a checking unit that checks theindividual's operation characteristic information extracted by theextraction unit against a registered user's operation characteristicinformation pre-registered in a storage medium; and an output unit thatoutputs permission information to the information processing apparatusin accordance with a checking result by the checking unit, thepermission information permitting the processing in accordance with useroperation of the input means to be performed on the informationprocessing apparatus. The extraction unit generates the individual'soperation characteristic information at least based on output time andoutput transition time, the output time being from output start time tooutput end time of the code output from the operation unit, and theoutput transition time being generated from the output end time of theoutput code and output start time of a code output subsequent to thecode.

According to the embodiment of the individual authentication processingapparatus of the present invention, the extraction unit generates theindividual's operation characteristic information on the basis of codeinterval time, which is a difference between the output start time ofthe code output from the operation unit and the output start time of thecode output subsequent to the code.

According to the embodiment of the individual authentication processingapparatus of the present invention, the checking unit performs thechecking processing by computing and comparing the registered user'soutput time and output transition time registered in the storage mediumwith the output time and the output transition time generated by theextraction unit.

According to the embodiment of the individual authentication processingapparatus of the present invention, the extraction unit weights and addsa difference between the registered user's output time registered in thestorage medium and the output time generated by the extraction unit anda difference between the registered user's output transition timeregistered in the storage means and the output transition time generatedby the extraction unit and compares the sum with a threshold.

According to the embodiment of the individual authentication processingapparatus of the present invention, the individual authenticationprocessing apparatus includes an operation unit serving as the inputmeans that outputs a code in accordance with the user operation; anextraction unit that extracts an individual's operation characteristicinformation based on output time from output start time to output endtime of the code output from the operation unit; a storage medium thatrecords the operation characteristic information every time the code isoutput from the operation unit; a rating unit that rates dispersion ofthe operation characteristic information recorded in the storage medium;a checking unit that compares the individual's operation characteristicinformation extracted by the extraction unit with a registered user'soperation characteristic information pre-registered in the storagemedium and performs the checking processing in accordance with thedispersion of the operation characteristic information rated by therating unit; and an output unit that outputs permission information tothe information processing apparatus in accordance with a checkingresult by the checking unit, the permission information permitting theprocessing in accordance with user operation of the input means to beperformed on the information processing apparatus.

According to the embodiment of the individual authentication processingapparatus of the present invention, the rating unit rates the dispersionon the basis of standard deviation of a plurality of output timescorresponding to the code.

According to the embodiment of the individual authentication processingapparatus of the present invention, the checking unit compares a ratedvalue against a threshold, the rated value being obtained by dividing adifference between output time stored in the storage means and outputtime newly generated by the extraction unit by the standard deviation.

A second aspect of the present invention is an individual authenticationprocessing method of performing individual authentication, including:

a step of obtaining normal operation information from normallyoperating, by a user, input means of an information processingapparatus;

a step of extracting an individual's operation characteristicinformation from the normal operation information and checking theindividual's extracted operation characteristic information against aregistered user's operation characteristic information stored in storagemeans; and

a step of generating, on the basis of a result of the checkingprocessing, permission information for determining whether or not topermit the processing in accordance with user operation of the inputmeans to be performed on the information processing apparatus andoutputting the generated permission information to the informationprocessing apparatus.

According to an embodiment of the individual authentication processingmethod of the present invention, when generating the permissioninformation, the individual authentication processing method refers topast checking log data stored in a checking result memory that storespast checking results and generates the permission information on thebasis of the checking log data.

According to the embodiment of the individual authentication processingmethod of the present invention, the operation characteristicinformation is information on characteristics of key input with akeyboard serving as the input means. The operation characteristicinformation is information including DDn representing time from pressinga previously input key to pressing a subsequently input key; UDnrepresenting time from pressing a key to releasing the key; and DUnrepresenting time from releasing the previously input key to pressingthe subsequently input key. The checking processing against theregistered user's operation characteristic information stored in thestorage means is performed by comparing a distance value d with apredetermined threshold, the distance value d being between inputvectors DD, UD, and DU formed of the DDn, UDn, and DUn and mean vectors[DD], [UD], and [DU] of the registered user's operation characteristicinformation stored in the storage means.

According to the embodiment of the individual authentication processingmethod of the present invention, the distance value d is computed on thebasis of the equation d=|DD−[DD]|+k|UD−[UD]|+l|UD−[DU]| where k and lare coefficients.

According to the embodiment of the individual authentication processingmethod of the present invention, the storage means stores integratedpieces of operation characteristic information data concerning the sameoperation by the registered user. The checking processing of theoperation characteristic information extracted from the normal operationinformation is performed by weighting less dispersed data of theintegrated pieces of characteristic information data concerning the sameoperation by the registered user, which are stored in the storage means,more heavily than widely dispersed data.

According to the embodiment of the individual authentication processingmethod of the present invention, the operation characteristicinformation is information on characteristics of key input with akeyboard serving as the input means. The operation characteristicinformation is information including DDn representing time from pressinga previously input key to pressing a subsequently input key; UDnrepresenting time from pressing a key to releasing the key; and DUnrepresenting time from releasing the previously input key to pressingthe subsequently input key. The checking processing against theregistered user's operation characteristic information stored in thestorage means is performed by comparing a distance value d with apredetermined threshold, the distance value d being computed on thebasis of the equationd=|(DD−[DD])/σDD|+k|(UD)−[UD])/σUD|+l|(DU−[DU])/σDU| where DD, UD, andDU are input vectors formed of the DDn, UDn, and DUn, [DD], [UD], and[DU] are mean vectors of the registered user's operation characteristicinformation stored in the storage means, σDD, σUD, and σDU are standarddeviation vectors obtained on the basis of the registered user'soperation characteristic information stored in the storage means, and kand l are coefficients.

According to the embodiment of the individual authentication processingmethod of the present invention, a keyword registration database isprovided that stores a word based on which the authentication processingis performed as a keyword. On condition that it is detected that theword registered in the keyword registration database is input from theinput means, the checking processing is performed on the basis of normaloperation information obtained from normally operating the input meansby the user.

According to the embodiment of the individual authentication processingmethod of the present invention, the normal operation information isinformation concerning an operation sequence of a mouse. The storagemeans stores the registered user's mouse operation sequence informationas the operation characteristic information. The checking processing isperformed by checking against the mouse operation sequence information.

According to the embodiment of the individual authentication processingmethod of the present invention, the normal operation information isinformation concerning a processing sequence of a program executable bythe information processing method. The storage means stores theregistered user's program processing sequence information as theoperation characteristic information. The checking processing isperformed by checking against the program processing sequenceinformation.

According to the embodiment of the individual authentication processingmethod of the present invention, the normal operation information isinformation on the frequency of inputting a specific key. The storagemeans stores the registered user's specific key inputting frequencyinformation as the operation characteristic information. The checkingprocessing is performed by checking against the specific key inputtingfrequency information.

A third aspect of the present invention is a computer program forperforming individual authentication, including:

a step of obtaining normal operation information from normally operatingby a user, input means of an information processing apparatus;

a step of extracting an individual's operation characteristicinformation from the normal operation information and checking theindividual's extracted operation characteristic information against aregistered user's operation characteristic information stored in storagemeans; and

a step of generating, on the basis of a result of the checkingprocessing, permission information for determining whether or not topermit the processing in accordance with user operation of the inputmeans to be performed on the information processing apparatus andoutputting the generated permission information to the informationprocessing apparatus.

The computer program of the present invention can be provided by, forexample, a storage medium that provides the computer program to ageneral computer system capable of performing various pieces of programcode in a computer-readable format, a communication medium, a recordingmedium such as a CD, FD, or MO, or a communication medium such as anetwork. By providing the program in the computer-readable format, theprocessing in accordance with the program is achieved on the computersystem.

Further objects, features, and advantages of the present invention willbecome apparent from the following description of the preferredembodiments with reference to the attached drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustration showing an example of a sequence of the knownauthentication processing and the user-operated input processing(example 1).

FIG. 2 is an illustration showing an example of a sequence of the knownauthentication processing and the user-operated input processing(example 2).

FIG. 3 is an illustration showing a sequence of the authenticationprocessing and the user-operated input processing according to thepresent invention.

FIG. 4 is a diagram showing an example of the configuration of a systemfor performing the authentication processing according to the presentinvention.

FIG. 5 is a flowchart for describing the processing by an authenticationprocessing apparatus according to the present invention.

FIG. 6 is a flowchart for describing the processing by an informationprocessing apparatus permitted or prohibited by the authenticationprocessing to perform the processing.

FIG. 7 is a diagram for describing operation information applicable tothe authentication processing according to the present invention.

FIG. 8 includes diagrams for describing differences between individualsin the operation information applicable to the authentication processingaccording to the present invention.

FIG. 9 is a diagram for describing an example of distribution ofdispersions and means of the operation information applicable to theauthentication processing according to the present invention.

FIG. 10 is a diagram for describing the checking processing of inputoperation information in the authentication processing that takes intoconsideration standard deviation according to the present invention.

FIG. 11 is a diagram showing an example of the configuration of a systemfor performing the keyword-based authentication processing according tothe present invention.

FIG. 12 is a flowchart showing the keyword-based processing by theauthentication processing apparatus according to the present invention.

FIG. 13 is a diagram showing an example of the configuration of a systemfor performing the processing according to the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

With reference to the drawings, an individual authentication processingapparatus and individual authentication processing method of the presentinvention will be described in detail.

Using FIG. 3, a processing sequence of an individual authenticationprocessing apparatus according to an embodiment of the present inventionwill now be described. Similar to FIGS. 1 and 2 which have beendescribed in the above description, FIG. 3 shows time course in theabscissa axis and illustrates the processing performed in accordancewith the flow of time. An authentication unit 301 performs theauthentication processing. The authentication unit 301 is provided inthe interior of an information processing apparatus used by unspecifiedusers, such as a PC serving as a user terminal or an informationterminal or financial terminal located in a public place, or a serverconnected with a network over which user input information can betransferred.

The authentication unit 301 stores operation characteristic informationon personal characteristics of user operations corresponding to apre-registered user in a storage unit (database), and the storedinformation serves as authentication information. Specific modes of theauthentication information are described in detail later. For example,various pieces of keyboard operation information include elapsed timedata indicating elapsed time from a previous key input to a subsequentkey input, time data indicating time during which a key is pressed, andtime data indicating time from releasing a previous key to pressing asubsequent key. These various pieces of keyboard operation informationare described in detail later.

The authentication unit 301 receives operation information obtained fromthe actual operation to make a processing request to an informationprocessing apparatus having the authentication unit and performsauthentication by checking the operation information against theauthentication information stored in the storage unit (database), thatis, the pre-obtained personal information based on the user operation.Since authentication is performed on the basis of operation informationextracted from the user's normal operation, authentication is performedin accordance with the operation involved in making the user'sprocessing request without causing the user to be aware of theauthentication processing.

With this configuration, authentication is performed every time aspecific user performs a normal operation. This prevents the problemdescribed with reference to FIG. 1 in that an operation by a differentuser is falsely recognized as an operation by an authenticate user andis thus executed. Since the user only performs operations in accordancewith normal operations, such as making a processing request or inputtingdata, the user is not required to perform the special processing forauthentication, such as inputting a password every time the userperforms an operation, as described in FIG. 2. The processing becomesless complicated, and the processing efficiency is enhanced.

FIG. 4 is a block diagram of the configuration of an informationprocessing system having an individual authentication processingapparatus of the present invention. With an input unit 403, a user 410performs a desired operation, such as inputting data or making aprocessing request to an information processing apparatus 401. The inputunit 403 includes, for example, various input units such as a keyboardand a mouse. The input unit operations include, for example, inputting aword with the keyboard, issuing an application execution (activation)request, designating a file, deleting a file, and clicking on an icon.

Operation information obtained from operating the input unit 403 by theuser 410 is input to the information processing apparatus 401 forperforming the processing based on the operation information and to anauthentication processing apparatus 404 for performing the individualauthentication processing. The information processing apparatus 401receives permission information from the authentication processingapparatus 404, the permission information being based on the result ofsuccessful/unsuccessful authentication, which is obtained by theauthentication processing by the authentication processing apparatus404, and determines on the basis of the receipt of the permissioninformation whether or not to perform the processing in accordance withthe operation information input from the input unit 403. When thepermission information indicates that the authentication is successful,the processing is performed. The processing result is output to, forexample, an output unit 402. The output unit 402 is formed of displaymeans, such as a CRT or LCD, or audio output means, such as a speaker.

The authentication processing apparatus 404 receives the operationinformation from the input unit 403 and extracts an individual'soperation characteristic information from the received operationinformation. The authentication processing apparatus 404 checks theindividual's extracted operation characteristic information againstauthentication information serving as a registered user's operationcharacteristic information stored in an authentication informationdatabase (DB) 406. On the basis of a result of the authenticationprocessing, the authentication processing apparatus 404 generatespermission information for determining whether or not to permit theprocessing to be performed on the information processing apparatus 401and outputs the permission information to the information processingapparatus 401. In the authentication information database (DB) 406, forexample, various pieces of keyboard operation information serving as theregistered user's authentication information are registered inconjunction with, for example, a user ID. On the basis of a user IDobtained from the input unit at the time the operation starts, theauthentication processing apparatus 404 obtains the registered user'sauthentication information from the authentication information database(DB) 406. The authentication information database (DB) 406 storesintegrated pieces of operation characteristic information dataconcerning the same operation by the registered user. The checkingprocessing is performed while mean values, dispersion, and standarddeviation of the stored data are taken into consideration. The specificmode of the checking processing is described later.

When the number of users for which authentication is performed is small,it is not essential to associate authentication information stored inthe authentication information database (DB) 406 with the user ID.Operation information input by a user may be checked against all piecesof authentication information stored in the authentication informationdatabase (DB) 406.

FIG. 5 shows a processing flow of the authentication processingapparatus 404. In accordance with the processing flow of FIG. 5, theprocessing performed by the authentication processing apparatus 404 willnow be described. In step S101, the authentication processing apparatus404 receives operation information based on user operation from theinput unit 403. In step S102, the authentication processing apparatus404 checks the input operation information against data stored in theauthentication information database (DB) 406. In step S103, theauthentication processing apparatus 404 stores the checking result in anauthentication result memory 405. The checking result is data indicatingwhether or not the input operation information agrees with the data inthe authentication information database (DB) 406. In step S104, theauthentication processing apparatus 404 obtains past checking resultsfrom the authentication result memory 405. The past checking resultsare, for example, authentication results of the checking performed onthe basis of a past series of pieces of operation information obtainedfrom a series of operations described using FIG. 3.

For example, when a series of pieces of authentication log data storedin the authentication result memory 405 indicate that authentication hasbeen continuously successful multiple times, if the most recent checkingresult indicates that the checked pieces of information agree with eachother, the authentication processing apparatus 404 determines that theauthentication is successful and thus permits the processing. Incontrast, when the results continuously indicate that the checked piecesof information disagree with each other multiple times, another user mayhave been repetitively trying to establish fraudulent access. It is thusdetermined that the authentication is unsuccessful, and the processingis thus prohibited. In this case, the number of times the checked piecesof information continuously can disagree with each other is preset bythe authentication processing apparatus 404.

Instead of making reference to the authentication log data in theauthentication result memory 405, authentication based on the checkingprocessing of the operation information obtained from the input unit 403against the data stored in the authentication information database (DB)406 may be performed. In this case, steps S103 and S104 are skipped.

In step S105, the authentication processing apparatus 404 generatespermission information based on at least one of the obtainedauthentication log data and the checking result. In step S106, theauthentication processing apparatus 404 outputs the permissioninformation to the information processing apparatus 401. The permissioninformation may be a processing permission signal based on successfulauthentication or a processing prohibition signal based on unsuccessfulauthentication. When authentication is successful and permissioninformation indicating that the processing is permitted is thus sent tothe information processing apparatus 401, in step S108, the operationinformation is registered in the Authentication information database(DB) 406, and the processing is terminated. When authentication isunsuccessful and permission information indicating that the processingis prohibited is sent, the operation information is not registered inthe authentication information database (DB) 406, and the processing isterminated.

Using FIG. 6, the processing by the information processing apparatus 401will now be described. The information processing apparatus 401 receivesoperation information based on user operation from the input unit 403.At the time the operation information is input, the processing based onthe operation information does not start. The information processingapparatus 401 waits for receipt of permission information from theauthentication processing apparatus 404.

When the information processing apparatus receives in step S202permission information indicating that the authentication by theauthentication processing apparatus 404 is successful or unsuccessful,in step S203, it is determined whether the received permissioninformation indicates that the processing is permitted or prohibited. Ifthe processing is permitted, in step S204, the processing in accordancewith the operation information that has been already input from theinput unit 403 is performed. In step S205, the processing result isoutput to the output unit 402. If it is determined in step S203 that theinput permission information indicates that the processing isprohibited, the processing in accordance with the input operationinformation is not performed, and the processing is terminated.

A specific example of the authentication processing performed by theauthentication processing apparatus 404 will now be described. A casewill now be described in which the authentication processing apparatus404 receives operation information input with a keyboard serving as theinput unit 403 and performs the individual authentication processingbased on operation information concerning the keyboard.

With regard to operation information concerning the keyboard, D_(n) isthe time at which n-th key of an input sequence (n-th character of aninput character string) is pressed, and Un is the time at which thepressed key is released. The authentication processing apparatus 404performs the authentication processing based on the following pieces ofoperation information:DD _(n) =D _(n) −D _(n−1)  (1)

This indicates time from pressing (n−1)th key of an input sequence((n−1)th character of an input character string) to pressing n-th key.UD _(n) =U _(n) −D _(n)  (2)

This indicates time from pressing n-th key of an input sequence (n-thcharacter of an input character string) to releasing n-th key.DU _(n) =D _(n) −U _(n−1)  (3)

This indicates time from releasing (n−1)th key of an input key sequence((n−1)th character of an input character string) to pressing n-th key.

The authentication information database stores the above-describedoperation information (1) to (3), which are input in accordance with auser permitted to perform the processing on the information processingapparatus.

FIG. 7 shows specific examples of the information (1) to (3). In theexamples shown in FIG. 7, the user inputs the character string [koji]with the keyboard. FIG. 7 indicates that time flows from left to right.

In FIG. 7, the top row indicates the time at which each character of thecharacter string [koji] is pressed and released. The above-described (1)DD_(n)=D_(n)−D_(n−1) corresponds to time shown in FIG. 7(1), that is,t(ko), t(oj), and t(ji); (2) UD_(n)=U_(n)−D_(n) corresponds to timeshown in FIG. 7(2), that is, s(k), s(o), s (j), and s(i); and (3)DU_(n)=D_(n)−U_(n−1) corresponds to r(ko,), r(oj), and r(ji) shown in(3) of FIG. 7.

For example, t(ko) of (1) indicates time from pressing (n−1)th character(k) of the keyboard to pressing n-th character (o) of the keyboard; s(o)of (2) indicates time from pressing to releasing n-th character (o) ofthe keyboard; and r(ko) of (3) indicates time from releasing (n−1)thcharacter (k) of the keyboard to pressing n-th character (o) of thekeyboard. The data (3) DU_(n)=D_(n)−U_(n−1) may have a negative value,such as r(ji) of FIG. 7(3).

According to this embodiment, in the authentication information database(DB) 406, at least one set of the above described (1)DD_(n)=D_(n)−D_(n−1), (2) UD_(n)=U_(n)−D_(n), and (3)DU_(n)=D_(n)−U_(n−1) is stored to serve as keyboard operationinformation corresponding to the user authenticated in the past and thuspermitted to perform the processing.

FIG. 8 shows data indicating that the above-described information (1)DD_(n)=D_(n)−D_(n−1) is applicable to individual identification servingas individual authentication. FIG. 8 shows data obtained from theabove-described (1) DD_(n)=D_(n)−D_(n−1) of two test subjects 1 and 2when they input the character string [nakamura] with the keyboard. InFIG. 8, (a) indicates data obtained from test subject 1, and (b)indicates data obtained from test subject 2. Each test subject inputsthe character string [nakamura] five times with the keyboard, and dataindicating time from pressing (n−1)th character of the keyboard topressing n-th character of the keyboard is obtained.

It is recognized that, when each test subject has performed the sameoperation or the same key input multiple times, each test subject hasperformed operations at approximately the same key pressing intervalsbetween characters. It is also clear that there is a distinct differencein the obtained data of DD_(n)=D_(n)−D_(n−1) between test subject 1 andtest subject 2. For example, the data (a) obtained from test subject 1indicates that the time interval between pressing [k] and pressing [a]is greater than the time interval between pressing [a] and pressing [m].In contrast, the data (b) obtained from test subject 2 indicates thatthe time interval between pressing [k] and pressing [a] is smaller thanthe time interval between pressing [a] and pressing [m]. As discussedabove, a distinct difference between individuals in inputting thecharacter string is recognized. It is thus possible to extract operationcharacteristics peculiar to each individual from the input processingperformed by each individual using the keyboard.

The authentication processing apparatus 404 checks the operationinformation on the user for which authentication is performed, which isinput with the input unit 403, against the registered data stored in theauthentication information database 406. Registered data is stored inthe authentication information database 406 every time theauthentication processing is performed and authentication is successful.A plurality of pieces of operation information data is stored for eachindividual. The checking processing have various modes. Specificexamples of the checking processing will now be described.

(A) Threshold Determination Processing Based on Norms of Data Vectors

Input data vectors DD, UD, and DU are formed on the basis of theabove-described (1) DD_(n)=D_(n)−D_(n−1), (2) UD_(n)=U_(n)−D_(n), and(3) DU_(n)=D_(n)=U_(n−1). The dimension of each vector is in accordancewith a plurality of key inputs of a character string. In other words, ifthere are n key inputs, the vector is n-dimensional. Mean vectors of theregistered data stored in the authentication information database 406are [DD], [UD], and [DU]. The distance d between the input data and theregistered mean data is defined by the following equation:d=|DD−{overscore (DD)}|+k|UD−{overscore (UD)}|+l|DU−{overscore(DU)}|  [Formula 1]

where {overscore (XY)} corresponds to the mean value [XY] in thedescription.

In the description, mean values are similarly written.

In the above equation, k and l are weight coefficients and are valuespreset by the authentication processing apparatus.

The distance value d defined by the above equation is compared with apredetermined threshold th. When the distance d is less than thethreshold th, that is, when the following holds true:d<th  [Formula 2]

it is determined that the authentication is successful. When the aboveexpression does not hold true, that is, when d≧th, it is determined thatthe authentication is unsuccessful.

Alternatively, the threshold is changed by, for example, loosely settingthe threshold in accordance with the authentication status based on apast series of authentication results achieved in a series ofoperations, which have been described using FIG. 3. The past series ofauthentication results are stored in the authentication result memory.In contrast, when the past series of authentication results continuouslyindicate that the checked pieces of information continuously disagreewith each other, another user may have been repetitively trying toestablish fraudulent access. In this case, the threshold is strictlyset.

(B) Threshold Determination by Normalized Distance Based on StandardDeviation of Data Vectors

Since the mean vectors [DD], [UD], and [DU] of the plurality of piecesof registered data stored in the authentication information database 406are applied to the above processing, that is, the norm-based processing,the same rating is applied to a case in which a plurality of pieces ofregistered data are dispersed widely and to a case in which the piecesof registered data are less dispersed. In order to perform more accuraterating, a distance rating scale for less dispersed registered data ismade different from that for widely dispersed registered data. Anexample is described in which normalization is applied to highly ratethe distance obtained from the less dispersed registered data.

FIG. 9 shows data indicating dispersions and means of key sequence dataDD of FIG. 8. FIG. 9 shows dispersions and mean values of a plurality ofpieces of registered data (1) DD_(n)=D_(n)−D_(n−1) obtained from testsubject 1 and test subject 2, that is, data indicating time frompressing (n−1)th character of the keyboard to pressing n-th character ofthe keyboard. The diagram makes it clear that each test subject'sregistered data includes relatively concentrated registered data andrelatively dispersed data.

For example, the time interval between the key input [u] and the keyinput [r] by test subject 2 shows a large dispersion. It is difficult toidentify an individual on the basis of the distance computed bycomparing such largely dispersed data with input data. In contrast, thetime interval between the key input [a] and the key input [m] by testsubject 2 generates concentrated data. The distance between such dataand data obtained from operation information is expected to be small. Ifthe distance is large, it is very likely that the data is input from adifferent user. In order to highly set the rating of the distancecomputed from such less dispersed data, standard deviation vectors ofthe registered data stored in the authentication information database406 are used.

Input data vectors serving as operation information corresponding to theabove-described (1) DD_(n)=D_(n)−D_(n−1), (2) UD_(n)=U_(n)−D_(n), and(3) DU_(n)=D_(n)−U_(n−1) are DD, UD, DU; mean vectors of the registereddata stored in the authentication information database 406 are [DD],[UD], and [DU]; and standard deviation vectors are σDD, σUD, and σDU.The distance d between the input data and the registered mean data isdefined by the following equation:

$\begin{matrix}{d = {{\frac{{DD} - \overset{\_}{DD}}{\sigma\;{DD}}} + {k{\frac{{UD} - \overset{\_}{UD}}{\sigma\;{UD}}}} + {l{\frac{{DU} - \overset{\_}{DU}}{\sigma\;{DU}}}}}} & \text{[Formula~~3]}\end{matrix}$

where k and l are weight coefficients in the above equation and arevalues preset by the authentication processing apparatus. The distance ddefined by the above equation is compared with a predetermined thresholdth. When the distance d is less than the threshold th, that is, when thefollowing holds true:d<th  [Formula 4]

it is determined that the authentication is successful. When the aboveexpression does not hold true, that is, when d≧th, it is determined thatthe authentication is unsuccessful.

By applying the standard deviation vectors σDD, σUD, and σDU of theregistered data stored in the database 406 to the above equation of[Formula 3] for computing the distance value, the distance value iscomputed wherein the distance between the less dispersed registered dataand the input data vectors is rated highly, and the distance between thelargely dispersed registered data and the input data vectors is ratedlow. FIG. 10 is a diagram for describing the concept of distance rating.Registered data (reference data) shown in the diagram has pieces of dataat measurement points (a) to (f). A case is shown in which data at eachmeasurement point shows a dispersion denoted by the vertical line. Forexample, the dispersion at the measurement point (a) is large, whereasthe dispersion at the measurement point (e) is small.

If rating data is bold-line data shown in the diagram, the differencebetween the bold-line data and the registered data (reference data)denoted by the thin line is computed as the distance. For example, sincedata at the measurement point (a) has a large dispersion, the rateddistance is n=0.3, that is, the distance is rated low. In a case of lessdispersed data at the measurement point (e), the rated distance isn=5.0, that is, the distance is rated highly. A value corresponding tothe sum of these distance values is compared with a threshold.Accordingly, the rating is performed with a heavier emphasis on themeasurement point having less dispersed data that indicates anindividual's characteristics in a clearer manner.

The authentication processing by the authentication processing apparatusin the above-described embodiment involves obtaining, by theauthentication processing apparatus, a character string that correspondsto a character string input from the input unit, from the registereddata stored in the authentication information database (DB) and checkingone character string against another. Accordingly, the authenticationprocessing is based on arbitrary keystrokes performed by a person forwhich authentication is performed using the input unit. Theauthentication processing requires no special key input. Theauthentication processing is thus executable in accordance with keyinput performed by a user to make a processing request to theinformation processing apparatus.

In the above embodiment, an example of the authentication processingusing operation information obtained by the key input processing usingthe keyboard has been described. The authentication processing apparatusis only required to perform authentication by checking operationinformation input from the input unit against various operationinformation registered in the authentication information database. Notonly the key input operation information but also various otheroperation information is applicable to the authentication processing.

For example, the authentication processing apparatus obtains informationconcerning a mouse operation sequence as input operation information,stores a registered user's mouse operation sequence information asoperation characteristic information in the authentication informationdatabase serving as storage means, and performs authentication bychecking against the mouse operation sequence information.Alternatively, the authentication processing apparatus obtainsinformation concerning a processing sequence of a program executable bythe information processing apparatus as input operation information,stores a registered user's program processing sequence information asoperation characteristic information in the authentication informationdatabase, and performs authentication by checking against the programprocessing sequence information. Alternatively, the authenticationprocessing apparatus obtains information indicating the frequency ofinputting a specific key as input operation information, stores aregistered user's specific key inputting frequency information asoperation characteristic information in the authentication informationdatabase, and performs authentication by checking against the specifickey inputting frequency information.

More specifically, operation habits, e.g., the frequency of clicking themouse, the speed of the mouse movement, the mouth track of selectingoperation (for example, straight line, curved line, zigzag, etc.), theclicking time interval when double clicking or triple clicking themouse, and the frequency of using a specific key of the keyboard(left/right shift keys, function keys, numerical keypad, etc.), arestored in the individual authentication database. Authentication is madepossible by checking operation information against these pieces ofregistered information.

Furthermore, operation types, e.g., the frequency of inputting aspecific word using the keyboard, the frequency of using eachapplication, the frequency of using each specific function of anapplication, and the window arrangement information in the windowsystem, are stored in the individual authentication database.Authentication is made possible by comparing operation informationagainst these pieces of registered information.

Furthermore, information or data obtained from a series of proceduresfor performing a specific operation, e.g., a plurality of processesperformed to activate an application, namely, double-clicking on anapplication icon, designating a file, double-clicking on a document dataicon, and activating a start menu, are stored in the individualauthentication database. Authentication is made possible by checkingoperation information against these pieces of registered information.Information obtained from a procedure for performing a specificoperation may also include information obtained from a procedure fordeleting a file, the procedure involving pressing a delete key, using atrash box, and right-clicking the mouse to delete the file, asregistered information. Furthermore, information concerning the use ofspecific functions, e.g., selecting and designating a process from amenu bar, selecting and activating an icon, right-clicking the mouse toselect an item from the menu, and using a shortcut key, are stored inthe individual authentication database as information obtained fromprocedures in accordance with a specific user interface. Authenticationis made possible by checking operation information against these piecesof registered information.

An embodiment will now be described in which at least one keyword isregistered in a keyboard database, the keyword being a frequentlyperformed key input sequence, whether or not there is an inputcorresponding to the registered keyword is determined, and theauthentication processing is performed only when it is determined thatthere is an input corresponding to the registered keyword.

FIG. 11 is a block diagram of the configuration of a system to which anindividual authentication processing apparatus of this embodiment isapplied. With an input unit 503, a user 510 performs desired operations.The input unit 503 is a keyboard.

Operation information obtained from operating, by the user 510, thekeyboard serving as the input unit 503 is input to an informationprocessing apparatus 501 for performing the processing based on theoperation information and to an authentication processing apparatus 504for performing the individual authentication processing. The informationprocessing apparatus 501 receives permission information from theauthentication processing apparatus 504 when the authenticationprocessing apparatus 504 performs the authentication processing anddetermines that the authentication is successful. On the basis of thereceipt of the permission information, the information processingapparatus 501 performs the processing in accordance with the operationinformation input from the input unit 503 and outputs the result to anoutput unit 502. The output unit 502 is formed of display means, such asa CRT or LCD, or audio output means, such as a speaker.

The authentication processing apparatus 504 checks a keyboard inputword, which serves as operation information input from the input unit503, against a word registered in a keyword database 520. When the twowords agree with each other, the authentication processing apparatus 504performs the authentication processing based on the checking processingof checking against authentication information stored in anauthentication information database (DB) 506. FIG. 12 shows a processingflow of the authentication processing apparatus 504.

In accordance with the processing flow of FIG. 12, the processing by theauthentication processing apparatus 504 will now be described. In stepS301, the authentication processing apparatus 504 receives operationinformation based on user operation from the input unit 503. In stepS302, the authentication processing apparatus 504 compares the inputoperation information (input word) against a keyword stored in thekeyword database and determines whether or not the word input from theuser is already registered.

When it is determined in step S303 that the input operation information(input word) agrees with the keyword stored in the keyword database, instep S304, the authentication processing apparatus 504 performs thechecking processing of the input operation information againstinformation in the authentication information database (DB). Theprocessing involves the checking processing concerning, for example, (1)DD_(n)=D_(n)−D_(n−1), (2) UD_(n)=U_(n)−D_(n), and (3)DU_(n)=D_(n)−U_(n−1), which have been described in the previousembodiment. In step S305, the authentication processing apparatus 504stores the checking result in an authentication result memory 505.

In step S306, the authentication processing apparatus 504 obtainschecking result log up to the present from the authentication resultmemory 505. In step S307, the authentication processing apparatus 504generates permission information on the basis of the obtainedauthentication log information. In step S308, the authenticationprocessing apparatus 504 outputs the permission information to theinformation processing apparatus 501. The permission information may bea processing permission signal based on successful authentication or aprocessing prohibition signal based on unsuccessful authentication. Whenauthentication is successful and permission information indicating thatthe processing is permitted is thus sent to the information processingapparatus 501, in step S310, the operation information is registered inthe authentication information database (DB) 506, and the processing isterminated. When authentication is unsuccessful and permissioninformation indicating that the processing is prohibited is sent, theoperation information is not registered in the authenticationinformation database (DB) 506, and the processing is terminated.

When it is determined in step S303 that the input operation information(input word) disagrees with the keyword stored in the keyword database,in step S311, the authentication processing apparatus 504 obtainschecking result log up to the present from the authentication resultmemory 505. In step S312, the authentication processing apparatus 504generates permission information on the basis of the obtainedauthentication log information. If the processing is to be permitted,the authentication processing apparatus 504 outputs the permissioninformation to the information processing apparatus 501. The permissioninformation is a processing permission signal based on successfulauthentication. In contrast, when the processing is to be prohibited, instep S315, the authentication processing apparatus 504 performs theprocessing to request the user to input a keyword. This is advantageousin a case in which, for example, when no keyword has been input in apredetermined number of past operations, such as n operations, the useris requested to input a keyword for performing keyword-basedauthentication, and multiple operations are permitted by theauthentication based on the keyword input once.

[System Configuration]

A series of processes by the authentication processing apparatus of thepresent invention described in the above-described embodiments can beperformed by hardware, software, or a combination of both. Whenperforming the software-based processing, a computer program havingrecorded therein a processing sequence is installed in a memory in adata processing apparatus included in dedicated hardware, and thecomputer program is thus executed. Alternatively, the program isinstalled in a general computer capable of performing various processes,and the program is thus executed. When performing the series ofprocesses by software, a program forming the software is installed in,for example, a general computer or a one-chip microcomputer. FIG. 13shows an example of the hardware configuration embodying the systemconfiguration of FIG. 4.

The system includes a CPU (Central Processing Unit) 602. The CPU(Central Processing Unit) 602 actually executes various applicationprograms and an OS (Operating System). A ROM (Read-Only-Memory) 603stores programs executed by the CPU 602 or fixed data serving asarithmetic parameters. A RAM (Random Access Memory) 604 is used as astorage area and/or a work area for programs executed by the CPU 602 andparameters changing in accordance with the processing of the programs.The CPU 602, the ROM 603, the RAM 604, and a hard disk 605 are connectedto one another by a bus 601 and can transfer data to one another. Also,data transfer between these components and various input/output unitsconnected to an input/output interface 611 is made possible.

A keyboard 612 and a mouse 613 are operated by a user to input variousinstructions to the CPU 602. The keyboard 612 and the mouse 613 areoperated to input command input data via a keyboard/mouse controller614.

A drive 609 is a drive for recording/reading a removable recordingmedium 610 such as a CD-ROM (Compact Disc Read Only Memory), an MO(Magneto optical) disc, a DVD (Digital Versatile Disc), a magnetic disc,or a semiconductor memory. The drive 609 reads a program or data fromeach removable recording medium 610 and stores a program or data in eachremovable recording medium 610.

When an instruction is input using the keyboard 612 or the mouse 613 viathe input/output interface 611, the CPU 602 executes a program stored inthe ROM (Read Only Memory) 603 in accordance with the input.

The CPU 602 can load not only a program stored in the ROM but also aprogram stored in the hard disk 605, a program transferred from asatellite or network, received at a communication unit 608, andinstalled in the hard disk 605, or a program read from the removablerecording medium 610 placed on the drive 609 and installed in the harddisk 605 into the RAM (Random Access Memory) 604 and execute theprogram.

In the system with the arrangement shown in FIG. 13, the CPU 602performs the processing in accordance with the above-describedembodiments or the processing in accordance with the above-describedblock diagrams and flowcharts. The CPU 602 sends the processing resultfrom the communication unit 608. If necessary, for example, the CPU 602outputs the processing result via, for example, the input/outputinterface 611 and the output unit 606 to a display device such as an LCD(Liquid Crystal Display) or a CRT. Also, the CPU 602 can store theprocessing result in a recording medium such as the hard disk 605 or thelike.

A program for performing various processes is pre-recorded in the harddisk 605 or the ROM 603 serving as a recording medium included in thesystem. Alternatively, the program may be temporarily or permanentlystored (recorded) in the removable recording medium 610 such as a floppydisc, a CD-ROM (Compact Disc Read Only Memory), an MO (Magneto optical)disc, a DVD (Digital Versatile Disc), a magnetic disc, or asemiconductor memory. Such a removable recording medium 610 can beprovided as so-called packaged software.

The program can be installed from the above-described removablerecording medium 610 into a computer. Alternatively, the program can bewirelessly transferred from a download site via an artificial satellitefor digital satellite broadcasting to a computer or transferred by wirethrough a network such as a LAN (Local Area Network) or the Internet toa computer. The computer receives the program transferred in such amanner at the communication unit 608, and the program is thus installedin the built-in hard disk 605.

In the description, processing steps for writing the program that causesthe computer to perform various processes are not required to beprocessed in time series in accordance with the order described in theflowcharts. Steps which are performed in parallel with one other orwhich are performed individually (for example, parallel processing orprocessing by an object) are also included.

The program can be processed by a single computer. Alternatively, theprogram can be processed by a plurality of computers in a decentralizedenvironment. Furthermore, the program can be transferred to a remotecomputer to be executed.

While the present invention has been described in detail with referenceto the specific embodiments, it is to be understood that modificationsand substitutions can be made by those skilled in the art withoutdeparting from the scope of the present invention. In other words, thepresent invention has been described using the embodiments only forillustration purposes and should not be interpreted in a limited manner.The scope of the present invention is to be determined solely by theappended claims.

Various processes described in this description are not only performedin time series in accordance with the written order, but also parallelor discrete processing of the processes in accordance with theprocessing capacity of an apparatus that performs the processes ispossible. The word system in this specification refers to the logicalintegrated configuration including a plurality of apparatuses and is notlimited to apparatuses in the same casing.

INDUSTRIAL APPLICABILITY

As is clear from the above description, according to the presentinvention, the authentication processing based on normal operationinformation obtained from normally operating an information processingapparatus is made possible. A user is thus not required to perform thespecial input processing for the authentication processing.

According to the present invention, the configuration implementsauthentication by applying a plurality of pieces of characteristicinformation serving as each individual's authentication informationwhile a plurality of different pieces of operation information, such asa plurality of keyboard input modes, are taken into consideration. Theuser authentication processing is thus performed with high accuracy.

According to the present invention, less dispersed data of a pluralityof pieces of operation information indicating an individual's extractedcharacteristics is weighted, and input operation information is checkedagainst the weighted information. The user authentication processing isthus performed with high accuracy.

1. An individual authentication processing apparatus for performingindividual authentication, wherein: the individual authenticationprocessing apparatus obtains normal operation information from normallyoperating, by a user, input means of an information processingapparatus; extracts an individual's operation characteristic informationfrom the normal operation information; is capable of checking theindividual's extracted operation characteristic information against aregistered user's operation characteristic information stored in storagemeans every time the normal operation information is obtained;generates, on the basis of a result of the checking processing,permission information for determining whether or not to permit theprocessing in accordance with user operation of the input means to beperformed on the information processing apparatus; and outputs thegenerated permission information to the information processingapparatus.
 2. The individual authentication processing apparatusaccording to claim 1, wherein, when generating the permissioninformation, the individual authentication processing apparatus refersto past checking log data stored in a checking result memory that storespast checking results, generates the permission information based on thechecking log data, and outputs the permission information to theinformation processing apparatus.
 3. The individual authenticationprocessing apparatus according to claim 1, wherein the operationcharacteristic information is information on characteristics of keyinput with a keyboard serving as the input means, the operationcharacteristic information is information including: DDn representingtime from pressing a previously input key to pressing a subsequentlyinput key; UDn representing time from pressing a key to releasing thekey; and DUn representing time from releasing the previously input keyto pressing the subsequently input key, and the checking processingagainst the registered user's operation characteristic informationstored in the storage means is performed by comparing a distance value dwith a predetermined threshold, the distance value d being between inputvectors DD, UD, and DU formed of the DDn, UDn, and DUn and mean vectors[DD], [UD], and [DU] of the registered user's operation characteristicinformation stored in the storage means.
 4. The individualauthentication processing apparatus according to claim 3, wherein thedistance value d is computed on the basis of the equationd=|DD−[DD]|+k|UD−[UD]|+l|UD−[DU]| where k and l are coefficients.
 5. Theindividual authentication processing apparatus according to claim 1,wherein the storage means stores integrated pieces of operationcharacteristic information data concerning the same operation by theregistered user; and the checking processing of the operationcharacteristic information extracted from the normal operationinformation is performed by weighting less dispersed data of theintegrated pieces of characteristic information data concerning the sameoperation by the registered user, which are stored in the storage means,more heavily than widely dispersed data.
 6. The individualauthentication processing apparatus according to claim 1, wherein theoperation characteristic information is information on characteristicsof key input with a keyboard serving as the input means, the operationcharacteristic information is information including: DDn representingtime from pressing a previously input key to pressing a subsequentlyinput key; UDn representing time from pressing a key to releasing thekey; and DUn representing time from releasing the previously input keyto pressing the subsequently input key, and the checking processingagainst the registered user's operation characteristic informationstored in the storage means is performed by comparing a distance value dwith a predetermined threshold, the distance value d being computed onthe basis of the equationd=|(DD−[DD])/σDD|+k|(UD)−[UD])/σUD−|+l|DU−[DU])/σDU| where DD, UD, andDU are input vectors formed of the DDn, UDn, and DUn, [DD], [UD], and[DU] are mean vectors of the registered user's operation characteristicinformation stored in the storage means, σDD, σUD, and σDU are standarddeviation vectors obtained on the basis of the registered user'soperation characteristic information stored in the storage means, and kand l are coefficients.
 7. The individual authentication processingapparatus according to claim 1, wherein the individual authenticationprocessing apparatus includes a keyword registration database thatstores a word based on which the authentication processing is performedas a keyword, and on condition that it is detected that the wordregistered in the keyword registration database is input from the inputmeans, the checking processing is performed on the basis of normaloperation information obtained from normally operating, by the user, theinput means in accordance with the input word.
 8. The individualauthentication processing apparatus according to claim 1, wherein thenormal operation information is information concerning an operationsequence of a mouse; the storage means stores the registered user'smouse operation sequence information as the operation characteristicinformation; and the checking processing is performed by checkingagainst the mouse operation sequence information.
 9. The individualauthentication processing apparatus according to claim 1, wherein thenormal operation information is information concerning a processingsequence of a program executable by the information processingapparatus; the storage means stores the registered user's programprocessing sequence information as the operation characteristicinformation; and the checking processing is performed by checkingagainst the program processing sequence information.
 10. The individualauthentication processing apparatus according to claim 1, wherein thenormal operation information is information on the frequency ofinputting a specific key; the storage means stores the registered user'sspecific key inputting frequency information as the operationcharacteristic information; and the checking processing is performed bychecking against the specific key inputting frequency information. 11.The individual authentication processing apparatus according to claim 1,wherein the individual authentication processing apparatus includes: anoperation unit serving as the input means that outputs a code inaccordance with the user operation; an extraction unit that extracts anindividual's operation characteristic information from normal operationinformation obtained from normally operating the operation unit by auser; a checking unit that checks the individual's operationcharacteristic information extracted by the extraction unit against aregistered user's operation characteristic information pre-registered ina storage medium; and an output unit that outputs permission informationto the information processing apparatus in accordance with a checkingresult by the checking unit, the permission information permitting theprocessing in accordance with user operation of the input means to beperformed on the information processing apparatus, wherein theextraction unit generates the individual's operation characteristicinformation at least based on output time and output transition time,the output time being from output start time to output end time of thecode output from the operation unit, and the output transition timebeing generated from the output end time of the output code and outputstart time of a code output subsequent to the code.
 12. The individualauthentication processing apparatus according to claim 11, wherein theextraction unit generates the individual's operation characteristicinformation on the basis of code interval time, which is a differencebetween the output start time of the code output from the operation unitand the output start time of the code output subsequent to the code. 13.The individual authentication processing apparatus according to claim11, wherein the checking unit performs the checking processing bycomputing and comparing the registered user's output time and outputtransition time registered in the storage medium with the output timeand the output transition time generated by the extraction unit.
 14. Theindividual authentication processing apparatus according to claim 11,wherein the extraction unit weights and adds a difference between theregistered user's output time registered in the storage medium and theoutput time generated by the extraction unit and a difference betweenthe registered user's output transition time registered in the storagemeans and the output transition time generated by the extraction unitand compares the sum with a threshold.
 15. The individual authenticationprocessing apparatus according to claim 1, wherein the individualauthentication processing apparatus includes: an operation unit servingas the input means that outputs a code in accordance with the useroperation; an extraction unit that extracts an individual's operationcharacteristic information based on output time from output start timeto output end time of the code output from the operation unit; a storagemedium that records the operation characteristic information every timethe code is output from the operation unit; a rating unit that ratesdispersion of the operation characteristic information recorded in thestorage medium; a checking unit that compares the individual's operationcharacteristic information extracted by the extraction unit with aregistered user's operation characteristic information pre-registered inthe storage medium and performs the checking processing in accordancewith the dispersion of the operation characteristic information rated bythe rating unit; and an output unit that outputs permission informationto the information processing apparatus in accordance with a checkingresult by the checking unit, the permission information permitting theprocessing in accordance with user operation of the input means to beperformed on the information processing apparatus.
 16. The individualauthentication processing apparatus according to claim 15, wherein therating unit rates the dispersion on the basis of standard deviation of aplurality of output times corresponding to the code.
 17. The individualauthentication processing apparatus according to claim 16, wherein thechecking unit compares a rated value against a threshold, the ratedvalue being obtained by dividing a difference between output time storedin the storage means and output time newly generated by the extractionunit by the standard deviation.
 18. An individual authenticationprocessing method of performing individual authentication, comprising: astep of obtaining normal operation information from normally operating,by a user, input means of an information processing apparatus; a step ofextracting an individual's operation characteristic information from thenormal operation information and capable of checking the individual'sextracted operation characteristic information against a registereduser's operation characteristic information stored in storage meansevery time the normal operation information is obtained; and a step ofgenerating, on the basis of a result of the checking processing,permission information for determining whether or not to permit theprocessing in accordance with user operation of the input means to beperformed on the information processing apparatus and outputting thegenerated permission information to the information processingapparatus.
 19. The individual authentication processing method accordingto claim 18, wherein, when generating the permission information, theindividual authentication processing method refers to past checking logdata stored in a checking result memory that stores past checkingresults and generates the permission information on the basis of thechecking log data.
 20. The individual authentication processing methodaccording to claim 18, wherein the operation characteristic informationis information on characteristics of key input with a keyboard servingas the input means, the operation characteristic information isinformation including: DDn representing time from pressing a previouslyinput key to pressing a subsequently input key; UDn representing timefrom pressing a key to releasing the key; and DUn representing time fromreleasing the previously input key to pressing the subsequently inputkey, and the checking processing against the registered user's operationcharacteristic information stored in the storage means is performed bycomparing a distance value d with a predetermined threshold, thedistance value d being between input vectors DD, UD, and DU formed ofthe DDn, UDn, and DUn and mean vectors [DD], [UD], and [DU] of theregistered user's operation characteristic information stored in thestorage means.
 21. The individual authentication processing methodaccording to claim 20, wherein the distance value d is computed on thebasis of the equation d=|DD−[DD]|+k|UD−[UD]|+l|UD−[DU]| where k and lare coefficients.
 22. The individual authentication processing methodaccording to claim 18, wherein the storage means stores integratedpieces of operation characteristic information data concerning the sameoperation by the registered user; and the checking processing of theoperation characteristic information extracted from the normal operationinformation is performed by weighting less dispersed data of theintegrated pieces of characteristic information data concerning the sameoperation by the registered user, which are stored in the storage means,more heavily than widely dispersed data.
 23. The individualauthentication processing method according to claim 18, wherein theoperation characteristic information is information on characteristicsof key input with a keyboard serving as the input means, the operationcharacteristic information is information including: DDn representingtime from pressing a previously input key to pressing a subsequentlyinput key; UDn representing time from pressing a key to releasing thekey; and DUn representing time from releasing the previously input keyto pressing the subsequently input key, and the checking processingagainst the registered user's operation characteristic informationstored in the storage means is performed by comparing a distance value dwith a predetermined threshold, the distance value d being computed onthe basis of the equationd=|(DD−[DD])/σDD|+k|(UD)−[UD])/σUD−|+l|(DU−[DU])/σDU| where DD, UD, andDU are input vectors formed of the DDn, UDn, and DUn, [DD], [UD], and[DU] are mean vectors of the registered user's operation characteristicinformation stored in the storage means, σDD, σUD, and σDU are standarddeviation vectors obtained on the basis of the registered user'soperation characteristic information stored in the storage means, and kand l are coefficients.
 24. The individual authentication processingmethod according to claim 18, wherein a keyword registration database isprovided that stores a word based on which the authentication processingis performed as a keyword, and on condition that it is detected that theword registered in the keyword registration database is input from theinput means, the checking processing is performed on the basis of normaloperation information obtained from normally operating the input meansby the user.
 25. The individual authentication processing methodaccording to claim 18, wherein the normal operation information isinformation concerning an operation sequence of a mouse; the storagemeans stores the registered user's mouse operation sequence informationas the operation characteristic information; and the checking processingis performed by checking against the mouse operation sequenceinformation.
 26. The individual authentication processing methodaccording to claim 18, wherein the normal operation information isinformation concerning a processing sequence of a program executable bythe information processing method; the storage means stores theregistered user's program processing sequence information as theoperation characteristic information; and the checking processing isperformed by checking against the program processing sequenceinformation.
 27. The individual authentication processing methodaccording to claim 18, wherein the normal operation information isinformation on the frequency of inputting a specific key; the storagemeans stores the registered user's specific key inputting frequencyinformation as the operation characteristic information; and thechecking processing is performed by checking against the specific keyinputting frequency information.
 28. A computer program for performingindividual authentication, comprising: a step of obtaining normaloperation information from normally operating, by a user, input means ofan information processing apparatus; a step of extracting anindividual's operation characteristic information from the normaloperation information and capable of checking the individual's extractedoperation characteristic information against a registered user'soperation characteristic information stored in storage means every timethe normal operation information is obtained; and a step of generating,on the basis of a result of the checking processing, permissioninformation for determining whether or not to permit the processing inaccordance with user operation of the input means to be performed on theinformation processing apparatus and outputting the generated permissioninformation to the information processing apparatus.